Not-so-Limited Warranty: Target Attacks 
on warranties for fun and profit 



Who am I? 



High school Student 

Senior in fall 

Warranty Enthusiast 

• Reading long paragraphs is fun 

Programmer for Cyberdyne Security Solutions 

New startup - cyberdynesecuritysolutions.com 

• Email me: Darkred@cybdss.com 



What is a serial number? 



• Any number used to identify a product 

• Can be for recall uses or warranty support 

• Types of serial number 

• Identifying - contains information such as year of 
production 

• Random - random values with no meaning 

Sequential - Used mainly in food 
(I23,i24,i25,etc.) 

• Usually located on the product 

• Sometimes accessible via software 



Why are serial numbers important? 



• Proof of ownership 

• I can now cancel your warranty - "I don't agree to 
the terms of the warranty" 

• Information Disclosure 

• Apple Information (See C# code) 

• Date of Purchase - "Where were you on day X?" 

• Report Stolen - Bye bye warranty 



How people get serial numbers 



• The Internet 

• Google Images is your fri 

• Calling people on craigsli 

• Emailing people on eBay 

• Stores 

• Flip over demo models 

• Guessing 

• Sequential serials are terrible 

• Owning the product 




Designed by Apple in California Assembled in China Model- A1219 
Rated 5V — 2A max. EMC 2311 Complies with the Canadian ICES-003 
Class B specifications. FCC ID: BCG-E2381 A and IC: 579C-E2381 A 
Serial l^flHHHI 



Things customer service does 
for legitimate repairs 



■ Makes up "Managers" and "Replacement 
departments' 7 

• "Let me just check with my head of imaginary 
replacements" 

■ Hangs up on you 

"Let me just check with my manager" <Click> 

■ Treats you like a criminal 

• "You broke the product not a defect!" 



Approaches c 




Technology impaired user 

"It just wont turn on" 

"No I don't know how to reformat it" 




a bad guy 




Angry guy 

"No its not my fault its yours!" 
"Let me speak to your manager!" 



Business Owner 

"I'm losing money every day!" 

"We need to get those reports done!" 



Examples of Security 



Ranked on: 

■Protection (higher score is better) 
■Obnoxiousness (lower is better) 



Pringles 



Countermeasures used: 

• Not really designed to protect against attacks 

• This is a good thing 

• Batch Code (sequential) 

• Good for recalls, not good for protection 



Protection 2/10 
Obnoxious Rating 1/10 



Low protection per product. 




® 



Lenovo 



Countermeasures used: 

• Serial Number 

• As many attempts as you want 

• Bulk checker (see C# code) 

• Regional Locks 

• Online warranty status displays what country 
Good protection per product. 

Protection 4/10 
Obnoxious Rating 4/10 




Amazon (Kindles) 



Countermeasures used: 

• Serial Number (non sequential) 

• As many attempts as you want 

• Gives you a month of Amazon prime when you 
are correct (Free bonus for doing bad things?) 

• Credit card on hold 

- Only $2 initially charged , 
Over the top protection per product. amaZOn 

Protection 7/10 
Obnoxious Rating 5/10 



Apple 



Countermeasures used: 

• Serial Number (non sequential) 

• Easy to generate (see C# Code) 

• AsksforlCCIDorlEMI 

• See C# Code for our solution 

• Credit card on hold 

• Full amount Initially Charged 
Insane protection per product . 

Protection 9/10 
Obnoxious Rating 10/10 



Protecting companies 



• No unlimited invalid serials 

• Nobody is going to misread their serial 200 times 

• Register Serial to account 

• Amazon has the right idea here 

• Non Intrusive replacement 

• Amazon does this and it works perfectly 

• No serials on demo models 
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